Tag: Litigation / Enforcement

  • The EU AI Transparency Code Now Has Signatories. That Makes Article 50 Harder To Ignore.

    The EU AI Transparency Code Now Has Signatories. That Makes Article 50 Harder To Ignore.

    The EU’s AI transparency Code of Practice is still voluntary.

    It is also getting harder to treat it like background noise.

    The European Commission has now published signatories to the General-Purpose AI Code of Practice, after already saying that the transparency code adequately covers Articles 50(2), (4), and (5) of the AI Act and after the AI Board adopted its own adequacy assessment. That combination matters more than either development standing alone. The Code is not binding law, and it is not the final Article 50 guidance. But it is starting to look like the Commission’s preferred operating lane for showing compliance with the AI Act’s transparency duties before those obligations begin applying on August 2, 2026.

    That is the part companies should pay attention to now.

    This is no longer just a story about Brussels publishing another voluntary framework. It is a story about the EU building a practical compliance path, naming who is willing to take it, and leaving everyone else to explain what they plan to do instead.

    For broader tracking context, see Clearon’s Laws, Bills & Regulations page.

    What Actually Changed

    There are now two official milestones that need to be read together.

    First, the Commission said on July 9 that, following its July 8 conclusion, the Code of Practice on Transparency of AI-generated content adequately covers the obligations in Articles 50(2), 50(4), and 50(5) of the AI Act and facilitates their effective implementation. The Commission page also says the AI Board adopted its adequacy assessment the same day.

    Second, the Commission’s General-Purpose AI Code of Practice page now publicly identifies signatories. The page names companies including Amazon, Anthropic, Google, Microsoft, Mistral AI, OpenAI, and others. It also says xAI signed only the Safety and Security chapter, which means transparency and copyright compliance would need to be demonstrated through other adequate means.

    That does not convert the Code into a mandatory rulebook. It does something more practical. It shows that the Commission’s preferred path is real, usable, and already being adopted by a visible group of companies.

    Why The Signatory List Matters More Than It May Look

    The July 9 adequacy assessment was important, but it still left a common reaction available: wait and see.

    A company could say the Code had moved in the right direction, but the real market test would come later. Would major providers and deployers actually sign? Would the Code become an industry norm or just a formal option on paper?

    The signatory list answers part of that question.

    Once the Commission names signatories, the discussion changes. Companies are no longer evaluating an abstract framework in isolation. They are evaluating whether to join a public compliance lane that peers are already using.

    That matters for at least three reasons.

    First, it creates a benchmark. A company that does not sign is no longer choosing between two equally hypothetical paths. It is choosing between a Commission-backed adequate Code with visible market uptake and a self-built approach that may have to be defended authority by authority.

    Second, it raises governance pressure inside companies. Legal, compliance, public policy, and product teams now have to answer a basic question from management: are we planning to sign, and if not, why not?

    Third, it increases the odds that the Code becomes the reference point for cross-border discussions about what "good enough" transparency implementation looks like in practice, even if it remains voluntary as a matter of law.

    Voluntary Does Not Mean Unimportant

    This is where AI Act coverage often gets flattened.

    Article 50 is the law. The Code is not. The final Commission guidelines on scope and implementation also still matter, and those guidelines have not been identified yet as final adopted guidance.

    But voluntary instruments can still become the practical center of gravity in compliance work.

    That happens all the time in regulated environments. A framework does not need to be binding to become the default evidence path. It only needs three things:

    • a regulator willing to point toward it;
    • a credible claim that it adequately covers the legal obligation; and
    • enough market uptake that declining to use it starts becoming a decision that must be justified.

    The EU transparency Code is getting closer to that position.

    The xAI Detail Is More Interesting Than It Looks

    The Commission page’s note that xAI signed only the Safety and Security chapter deserves more attention than a generic signatory headline.

    That detail is useful because it shows the Code is not just a symbolic coalition list. It shows chapter-level choices still matter and that partial participation can carry legal consequences for how compliance must be demonstrated.

    In the Commission’s framing, if a company does not sign the relevant transparency and copyright chapters, it must show compliance through other adequate means. That is a more concrete version of a broader AI-law pattern Clearon has been tracking: regulators may allow flexibility, but they increasingly expect companies to prove why their alternative is good enough.

    For companies watching from the outside, the takeaway is simple. Choosing not to follow the default path is still allowed. It is just not cost-free from a governance and evidence perspective.

    What Article 50 Still Requires

    The signatory list does not change what Article 50 is about.

    The core obligations still concern transparency around AI-generated or AI-manipulated content, including deepfakes and certain text published to inform the public on matters of public interest. The broader Article 50 framework also covers user notice when people interact with an AI system in contexts where that disclosure is required.

    The operational point remains the same as it was when the final Code first appeared: most of the real work sits behind the label.

    Companies still need to know:

    • which systems and workflows generate or manipulate content in scope;
    • whether they are acting as providers, deployers, or both;
    • when content crosses into deepfake or public-interest-text territory;
    • what machine-readable marking or provenance measures exist;
    • where visible labels or notices must appear;
    • whether those disclosures survive syndication, reposting, cropping, remixing, and downstream distribution; and
    • what records show the organization made and implemented reasoned decisions.

    The signatory list does not solve those questions. It makes them harder to postpone.

    Why This Calls For A Longer Read, Not A Short Update

    A short item could have said that signatories were published. That would have been true, but it would have missed the point.

    The real development is not just publication of names. It is the way three developments now fit together:

    1. the final transparency Code was published;
    2. the Commission and AI Board said it adequately covers the relevant Article 50 duties; and
    3. major companies are now publicly identified as signatories.

    Put together, that looks less like a minor implementation note and more like the emergence of a default compliance architecture ahead of the August 2 deadline.

    That is why a longer article makes sense. The legal status has not changed from voluntary to mandatory, but the practical status has changed from "one option among many" to something closer to "the path everyone will have to evaluate explicitly."

    What Companies Should Decide Now

    The immediate question is not whether Article 50 matters. It does.

    The immediate question is whether the company wants to align with the Commission-backed path or defend a custom alternative.

    That choice should trigger a real internal review.

    At a minimum, companies should decide:

    • whether they are likely to sign the relevant transparency commitments;
    • which products, publishing flows, and synthetic-content use cases fall within scope;
    • who owns the classification calls for deepfakes and public-interest text;
    • how labels, notices, icons, or machine-readable markers will actually be deployed;
    • what business units need to change workflows before August 2;
    • what evidence will be kept to show the controls were not just designed but used; and
    • how the eventual final Article 50 guidelines will be folded into the existing plan.

    For many organizations, the hardest part will not be writing a disclosure sentence. It will be assigning ownership across product, legal, trust and safety, editorial, policy, and engineering teams.

    What Practical Planning Should Look Like

    Companies should be planning this as a workflow project with legal ownership, not as a last-minute content-labeling task.

    The first step is role mapping. Many organizations will be both providers and deployers in different contexts. A company may provide a generative AI tool to customers, use a different model internally for marketing or publishing, and also operate chatbot or search-style interfaces. Those roles should be mapped product by product and workflow by workflow instead of being answered once at a policy level.

    The second step is content mapping. Teams should identify where AI-generated or AI-manipulated audio, images, video, and text are created, edited, approved, published, syndicated, or redistributed. The important question is not just whether the company uses generative AI. It is where synthetic content enters production systems, whether it stays machine-readable, and where public-facing disclosures may be lost.

    The third step is decision mapping. Someone has to own judgments about whether material is a deepfake, whether text concerns a matter of public interest, whether an interface requires a user notice, and whether enough human review or editorial responsibility exists to affect how the output is treated. If those calls are left vague, the company will end up with inconsistent labeling across teams and channels.

    The fourth step is control testing. Labels, icons, notices, provenance data, and machine-readable markers should be tested in the environments that matter most: web pages, mobile surfaces, social posts, video clips, images, PDFs, partner distribution channels, press workflows, and republished content. A disclosure that disappears during export, reposting, clipping, or formatting conversion is not much of a control.

    The fifth step is evidence design. Companies should assume they may later need to show not only that a policy existed, but that the policy was used. That means keeping records of role classifications, workflow decisions, labeling rules, exceptions, review steps, implementation dates, and testing results. If a company chooses not to sign the Code, this documentation matters even more because the alternative path will need to be defended as adequate on its own terms.

    A Sensible Near-Term Plan

    For companies trying to get from policy discussion to execution, a practical short-term plan would look something like this.

    In the next two weeks:

    • identify the products, publishing flows, and public-facing content systems most likely to fall within Article 50;
    • assign one accountable owner across legal or compliance and one operational owner across product or content operations;
    • decide whether the company is evaluating signature as the default path or only as one option among several; and
    • create a short issue list for unresolved scope questions, especially around deepfakes, public-interest text, and user-notice triggers.

    In the next month:

    • inventory existing labeling, disclosure, watermarking, provenance, and notice controls;
    • test how those controls behave across distribution channels and downstream formats;
    • write working rules for when disclosures must appear and who can approve exceptions;
    • build review checkpoints into publishing, moderation, and launch workflows; and
    • start collecting implementation evidence in a place legal and compliance teams can actually retrieve later.

    Before Article 50 goes live:

    • decide whether to sign the relevant commitments or rely on another approach;
    • close the highest-risk gaps in content workflows that publish synthetic media or public-interest text;
    • train the teams making real-world classification and publishing decisions;
    • align external messaging so product, legal, policy, and communications teams are not describing the controls differently; and
    • update the plan again when the final Commission guidelines arrive.

    That is not glamorous work, but it is the work that determines whether Article 50 compliance is real or performative.

    What To Watch Next

    Three follow-up items still matter.

    First, final Commission Article 50 guidelines would be a bigger legal implementation event than another signatory-page refresh. Those guidelines should help narrow scope and application questions that the Code alone does not fully settle.

    Second, changes to the signatory list matter because they will show whether the Code is stabilizing as an industry norm or whether visible holdouts remain.

    Third, enforcement and dispute posture matter. The more Article 50 becomes operational, the more courts, regulators, publishers, and counterparties will test whether companies actually did the classification, notice, and recordkeeping work they claimed to have done.

    That is where this stops being a transparency branding exercise and becomes legal infrastructure.

    Bottom Line

    The signatory list by itself is modest. Combined with the Commission’s adequacy assessment and the approaching Article 50 deadline, it marks a more meaningful shift. The EU has not made the transparency Code binding law. It has done something that may matter almost as much in practice: it has made the Code look like the default path companies will be expected to consider, and possibly expected to explain if they reject.

    That is a real compliance development, and it is worth treating like one.

    Sources

  • The Great American AI Act Draft Is Really a Federal Preemption Fight With a Frontier-Audit Regime

    The Great American AI Act Draft Is Really a Federal Preemption Fight With a Frontier-Audit Regime

    The Great American Artificial Intelligence Act is easy to describe badly.

    It is not an enacted Federal AI law. It is not even an introduced bill yet. It is a discussion draft released by Representatives Lori Trahan and Jay Obernolte with official supporting materials inviting feedback before formal introduction.

    That said, it is still worth reading because it shows what one serious bipartisan Federal AI framework may try to do.

    The most important point is not just that the draft creates frontier-model transparency, audits, and a new Federal standards center. It is that the draft tries to split AI regulation into two lanes:

    • Federal rules for model development and frontier safety; and
    • continued state authority over deployment, use, and generally applicable law.

    That split is where the real fight will be.

    The Short Answer

    • The Great American AI Act is currently a discussion draft, not introduced legislation and not law.
    • The draft would create a Federal frontier-governance regime centered on published risk frameworks, model-specific transparency reports, critical-safety-incident reporting, independent verification audits, and whistleblower protections.
    • It would also preempt state laws that specifically regulate AI model development, while preserving state laws of general applicability and state rules governing deployment or use of AI systems after the model stage. The official FAQ says that preemption would sunset three years after enactment.

    The Draft Is Trying To Create One Federal Rulebook For Frontier Development

    The official section-by-section and FAQ materials make the architecture fairly clear.

    The draft would formally establish a Center for AI Standards and Innovation, or CAISI, within the Department of Commerce. According to the section-by-section summary, CAISI would develop voluntary standards and best practices, evaluate AI systems, support synthetic-content detection tools, and administer the licensing regime for independent verification organizations.

    The frontier-governance pieces then stack on top of that center.

    According to the section-by-section summary, large frontier developers would have to write, implement, comply with, and publicly post a frontier AI framework covering catastrophic-risk thresholds, model-weight cybersecurity, internal and external deployment decisions, and related governance practices. Before or at deployment of a new frontier model, they would also have to publish a model-specific report describing release date, supported languages, modalities, intended use, restrictions, risk assessments, and mitigation steps.

    The section-by-section summary also says developers would have to report critical safety incidents to CAISI, with State attorneys general able to opt into receiving those reports.

    That is already a lot more concrete than generic calls for "responsible AI."

    The Audit Structure Is Not Voluntary

    Another major part of the draft is the independent verification regime.

    The section-by-section summary says CAISI would license independent verification organizations, or IVOs, and large frontier developers would have to retain licensed IVOs to audit compliance and assess whether the developer’s framework achieves acceptable levels of catastrophic-risk mitigation.

    Those organizations would get access to company materials, submit reports to CAISI, and provide a channel for corrective action and more frequent review if risk changes.

    That matters because the draft is not relying only on self-attestation. It is trying to build a recurring third-party review structure around the largest frontier developers.

    If a future bill keeps that structure, companies should expect the compliance file to include more than a policy page and a red-team slide deck. It would need documented frameworks, incident reporting, audit access, governance controls, and a defensible explanation of how catastrophic risk is being measured and mitigated.

    The Sharpest Provision Is The Preemption Section

    The real legal flashpoint is section 121.

    The draft says no state or political subdivision may establish or enforce any law or regulation specifically regulating the development of any AI model. That is the clean preemption sentence.

    The surrounding text matters just as much. The same section says it does not preempt:

    • state laws of general applicability;
    • common-law remedies; or
    • state laws and regulations that apply to activities occurring upon or after deployment, including implementation, deployment, distribution, offering, or use of AI systems, products, or services built from the model.

    The official FAQ goes further and says the framework would preserve state regulation of post-deployment or use-stage harms, including areas like hiring, housing, health care, education, chatbots, deepfakes, child sexual abuse material, and consumer privacy. The same FAQ says the preemption would sunset three years after enactment.

    That is why this draft is better understood as a Federal-state line-drawing proposal than a generic AI bill.

    Why The Preemption Debate Will Be Hard

    The draft is trying to do something politically familiar.

    It says model development should face one Federal rulebook, while states keep room to regulate downstream uses and harms. The official materials even compare that structure to national vehicle standards with state rules of the road.

    There is a logic to that.

    Frontier developers do not want fifty different state development-stage obligations, especially when those duties touch testing, documentation, training, or internal governance. At the same time, states are unlikely to give up their role in policing consumer protection, employment, health care, education, or chatbot harms that show up after deployment.

    The practical question is where "model development" stops and "deployment or use" begins.

    That line will not always be clean. A transparency rule, watermarking rule, or documentation rule can look like development-stage governance from one angle and user-facing product regulation from another. The official FAQ itself highlights that tension by listing specific state laws the drafters view as federalized or preempted.

    The Draft Also Shows Which Companies The Drafters Care About Most

    The supporting materials suggest the framework is aimed at the largest frontier developers rather than every startup or open-source project.

    The section-by-section summary says the transparency regime would apply to large frontier developers with more than $500 million in revenue. The FAQ also frames the bill as focusing obligations on frontier companies while giving startups and smaller builders more room.

    That does not mean smaller companies can ignore it.

    If Congress keeps this structure, the Federal debate may center on a frontier tier first, while states keep regulating use-stage harms lower down the stack. Smaller companies could still feel those downstream state laws even if the heaviest Federal development-stage duties land elsewhere.

    What Companies Should Watch

    For now, this is still a discussion draft. That status matters and should not be blurred.

    Still, the draft is worth tracking closely if any of these questions matter to the business:

    • would the company fall into a frontier-developer bucket if revenue and model-capability thresholds survive;
    • does the company already have a publishable risk framework, incident-reporting process, and audit-ready governance file;
    • how much of the company’s state-law exposure sits at the model-development layer versus the deployment or product-use layer; and
    • would preemption help the company, or would the operational pain simply move into downstream state rules on use, distribution, privacy, employment, health care, or consumer deception.

    The most useful reading is not "Federal AI bill exists." It is "a bipartisan draft is trying to define which AI risks belong to Washington and which still belong to the states."

    Bottom Line

    The Great American AI Act discussion draft is not law yet, but it is a serious marker of where Federal AI governance negotiations could go.

    Its structure matters more than its name. The draft would pair frontier transparency, incident reporting, third-party audits, and whistleblower protections with a temporary preemption rule for state laws specifically regulating model development, while preserving state authority over use-stage harms and general law.

    That is the real issue to watch. If Congress moves on AI, one of the hardest questions will not be whether there should be regulation. It will be who gets to regulate which layer of the stack.

    Sources

  • Rhode Island Splits AI Risk Between Companion Chatbots and Mental-Health Care

    Rhode Island Splits AI Risk Between Companion Chatbots and Mental-Health Care

    Rhode Island’s latest AI package is useful because it does not pretend every chatbot problem is the same.

    The General Assembly approved one bill aimed at companion-style AI and another aimed at the use of artificial intelligence in therapy and psychotherapy settings. That split matters because the compliance questions are different.

    One bill is basically a product-safety and disclosure measure for AI companions. The other is a professional-practice and patient-protection measure for mental-health care. Treating them as one generic "AI safety" story would hide the most practical part.

    As of this update, the cleanest official Rhode Island source I found is the General Assembly’s June 8 announcement that both measures were approved and sent to the governor for consideration. So the article below focuses on what the legislature approved and why the two-bill structure is worth watching closely.

    The Short Answer

    • Rhode Island’s legislature approved separate AI measures for companion-chatbot safety and for AI use in mental-health care.
    • The companion bill would require crisis protocols, recurring notices that the user is not interacting with a human, annual Attorney General reporting, and expose operators to civil penalties up to $15,000 per day.
    • The mental-health bill would limit how AI can be used in therapy and psychotherapy services, require informed written consent for certain recorded or transcribed sessions, bar unlicensed entities from offering therapy through AI, and keep therapeutic decisions with licensed professionals.

    Rhode Island Is Drawing Two Different Regulatory Lines

    A lot of AI-law coverage still treats emotionally responsive systems, therapy-like systems, and ordinary chat interfaces as one category.

    Rhode Island does not.

    Its legislature approved one bill for "artificial intelligence companion models" and another called the "Oversight of Artificial Intelligence Technology in Mental Health Care Act." That is a useful signal because it suggests lawmakers are distinguishing between:

    • consumer-facing systems designed to simulate sustained human-like relationships; and
    • clinical or quasi-clinical use of AI in actual therapy settings.

    Those are different products, different risks, and different compliance owners.

    The Companion Bill Is About Crisis Protocols and Nonhuman Notice

    H 7350 Substitute A as amended would create a new chapter on artificial intelligence companion models.

    The definition matters. The bill does not cover every chatbot. It targets systems that simulate a sustained human or human-like relationship by retaining information across sessions, asking unprompted emotion-based questions, and sustaining ongoing personal dialogue. It also excludes ordinary customer-service systems, research or technical-assistance tools, and internal productivity uses.

    That narrower definition is exactly what makes the bill practical.

    For covered operators, the bill would make it unlawful to operate or provide an AI companion unless the system contains a protocol addressing:

    • possible suicidal ideation or self-harm expressed by a user;
    • possible physical harm to others expressed by a user; and
    • referral to crisis services as soon as those expressions are detected.

    The bill would also require a clear and conspicuous notice at the beginning of an interaction and at least every three hours of continued interaction stating verbally or in writing that the user is not communicating with a human.

    That recurring-notice structure is worth noticing. Rhode Island is not treating disclosure as a buried one-time term. It is treating nonhuman notice as an ongoing duty for relationship-style systems.

    Beginning July 1, 2027, operators would also have to file annual reports with the Attorney General including the number of safety-protocol activations and related metrics, with aggregated data published on the Attorney General’s website.

    The enforcement section is not symbolic. It would authorize Attorney General enforcement and civil penalties of up to $15,000 per day, with fines directed to suicide-prevention programs. The bill text says it would take effect on January 1, 2027.

    The Mental-Health Bill Is Not A Chatbot-Disclosure Rule

    H 7349 Substitute A does something different.

    It is not mainly about telling a user they are talking to AI. It is about limiting how AI can be used in therapy and psychotherapy services and preserving the role of licensed professionals.

    The bill defines administrative support, supplementary support, therapeutic communication, consent, and permitted uses of AI. It then builds several restrictions on top of those definitions.

    Most importantly, it would prohibit licensed professionals or providers from using AI designed to simulate emotional attachment, bonding, or dependency, or AI companions for mental health or emotional support, to assist in supplementary support or therapeutic communication in therapy or psychotherapy services where the client’s therapeutic session is recorded or transcribed unless the patient or authorized representative is informed in writing and provides consent.

    That written disclosure must cover:

    • that AI will be used;
    • the specific purpose of the AI tool or system; and
    • written consent to that use.

    The bill would also bar any individual, corporation, or entity from providing, advertising, or otherwise offering therapy or psychotherapy services, including through Internet-based AI, unless those services are conducted by a licensed professional or provider.

    That is a harder line than a lot of generic "AI in healthcare" commentary suggests.

    Therapeutic Decisions Stay With Humans

    The part many companies should read most carefully is the section limiting what a licensed professional may let AI do.

    Under the bill, a licensed professional or provider could not allow AI to:

    • make independent therapeutic decisions;
    • directly interact with clients in therapeutic communication without an established treatment relationship and appropriate consent; or
    • determine therapeutic recommendations or treatment plans.

    The provider retains responsibility for clinical judgment and reasonable therapeutic oversight of the patient’s use of the system, though not for vendor-controlled design, algorithms, or outputs.

    That is a strong statement about where Rhode Island thinks professional responsibility should stay. The tool can assist around the edges. It cannot own the treatment decision.

    The bill also adds a confidentiality section and gives the Executive Office of Health and Human Services investigative authority. The text says the act would take effect upon passage.

    Why The Two-Bill Structure Matters

    The practical lesson is that Rhode Island is not regulating "AI" in the abstract.

    It is assigning duties based on use case.

    If a product is built to simulate emotional attachment or companionship, the pressure point is crisis response, recurring nonhuman disclosure, and reporting. If a product is used in therapy or psychotherapy, the pressure point is consent, licensure, confidentiality, and preserving human clinical judgment.

    That split is more useful than a broad AI-principles statute because it maps directly to product, legal, and operational questions companies can actually answer.

    What Companies Should Review Now

    If these Rhode Island measures matter to the business, the near-term review should be concrete:

    • decide whether any product could fit the legislature’s companion-model definition rather than an ordinary support-tool definition;
    • identify where self-harm and violence escalation protocols live and who owns crisis-referral design;
    • review whether recurring nonhuman disclosures can actually be delivered and logged during long-running sessions;
    • determine whether any mental-health or wellness product is drifting into therapy or psychotherapy claims;
    • review whether recorded or transcribed sessions involving AI would require a separate written-consent workflow; and
    • make sure no vendor or marketing language implies that AI itself is offering therapy where licensure rules would say otherwise.

    The bigger point is simple. A lot of AI risk is becoming a classification problem first. What kind of system is this, what kind of use is this, and which rule set attaches once that label is accurate?

    Bottom Line

    Rhode Island’s legislature approved two AI bills because it appears to see two different problems.

    Companion systems raise disclosure, crisis-intervention, and engagement-risk questions. Therapy-related systems raise licensure, consent, confidentiality, and clinical-judgment questions. That separation is the real takeaway.

    Even before final governor status is confirmed, the bill texts are a useful picture of where state safeguards are heading. Companies that build emotionally responsive AI or use AI around mental-health services should not treat those as the same compliance lane.

    Sources

  • Connecticut’s Public Act 26-15 Shows How State AI Compliance Actually Arrives

    Connecticut’s Public Act 26-15 Shows How State AI Compliance Actually Arrives

    Connecticut’s AI law is no longer a bill to watch.

    SB 5 was signed on May 27 as Public Act 26-15, and that enacted status matters because the law does not read like one abstract AI-principles document. It reads like a stack of operational rules with different effective dates, different targets, and different compliance owners.

    That is probably the most useful thing about it.

    Public Act 26-15 does not try to settle every AI policy fight at once. It puts real duties into places companies already understand: companion-chatbot safety, workplace decision tools, synthetic-content provenance, workforce programs, and youth-platform design. That is much closer to how AI compliance is likely to arrive in practice.

    The Short Answer

    • Connecticut's SB 5 is enacted as Public Act 26-15.
    • The law includes staggered requirements touching AI companions, employment-related automated decision tools, provenance for certain public generative-AI systems, frontier-developer whistleblower protections, and youth-platform safeguards.
    • For many businesses, the most practical near-term items are the October 1, 2026 provenance and employment provisions, the January 1, 2027 companion-chatbot safeguards, and the October 1, 2027 trigger for certain employment-tool deployment duties.

    Why The Enacted Version Matters More Than The Bill Debate

    A lot of AI-law coverage treats passage as the interesting moment and implementation as the footnote.

    With Connecticut, the implementation is the story.

    The enacted law is broad, but it is not one uniform compliance event. It is a phased package. Some parts are effective in mid-2026, some in October 2026, some in January 2027, some in October 2027, and some youth-platform provisions arrive in 2028.

    That means legal teams should stop asking whether Connecticut passed "an AI law" and start asking which business function owns which date.

    The Employment Piece Is One Of The Most Concrete

    The workplace provisions are likely to be the most immediate operational issue for many companies.

    Public Act 26-15 defines automated employment-related decision technology and sets up a developer-deployer structure for related obligations. Starting October 1, 2026, the statutory framework is in place. For deployers using covered tools on or after October 1, 2027, the law requires disclosure when an employee or applicant is interacting with such technology unless a reasonable person would think that is obvious.

    Before an employment-related decision is made, the deployer must also provide written notice describing:

    • that the technology has been deployed,
    • the purpose of the technology and the nature of the decision,
    • the trade name of the technology,
    • the categories of personal data it will analyze or process and how that data will be assessed,
    • the source of that data, and
    • contact information for the deployer.

    The law also says use of automated employment-related decision technology is not a defense to a discrimination complaint. That is a clean point legal teams should not miss.

    In other words, Connecticut is not treating workplace AI as a novelty. It is treating it as another decision system that can create notice, documentation, and discrimination exposure.

    The Companion-Chatbot Rules Are Not Cosmetic

    Starting January 1, 2027, Connecticut adds another enacted state model for companion-style AI.

    The law defines an artificial intelligence companion in a way that turns on sustained, anthropomorphic, relationship-like interaction while carving out a range of ordinary business and operational chat uses. That definitional line matters because it tries to separate companion-style consumer products from ordinary support and productivity tooling.

    For covered companions, the law requires operators to use evidence-based methods to detect user expressions clearly indicating risk of suicide, self-harm, or imminent physical violence and to institute measures to prevent the system from generating outputs that encourage those harms. If such a signal is detected, the operator must refer the user to appropriate crisis resources.

    The law also requires clear and conspicuous notice when a reasonable user might think they are interacting with a human rather than an AI companion. And for minor users, the law adds additional safeguards around self-harm, suicidal ideation, violence, disordered eating, alcohol, drugs, sexual exploitation, and parental management tools.

    This is not just a disclosure rule. It is a product-safety and response-protocol rule.

    Connecticut Also Moves On Provenance

    Another part of the law, effective October 1, 2026, applies to certain publicly accessible generative-AI providers with more than one million monthly users.

    That section requires covered providers, to the extent commercially and technically reasonable, to include provenance data in covered audio, image, or video content created or materially altered by the provider's generative-AI system, and to use reasonable methods to make that provenance data difficult to tamper with, remove, or separate from the content.

    That matters for two reasons.

    First, it shows Connecticut is willing to move beyond general transparency rhetoric into implementation detail around synthetic-content authenticity. Second, it uses a familiar enforcement model: unfair or deceptive trade practice treatment, enforced solely by the Attorney General, with no private right of action.

    Frontier Developers And Internal Reporting Are In The Mix Too

    The law also includes a frontier-developer section effective January 1, 2027.

    Large frontier developers must maintain a reasonable internal process for anonymous reporting by covered employees who in good faith identify activity posing a specific and substantial public-health or public-safety danger tied to catastrophic risk. The law also requires updates, board-level sharing in most cases, and notice of employee rights.

    That does not affect every company. It still matters as a signal.

    Connecticut is treating frontier-model governance not just as a public-policy debate, but as an internal reporting, employee-protection, and documentation issue.

    The Effective-Date Map Matters

    The biggest practical mistake would be treating Public Act 26-15 as one single compliance date.

    The rough timing looks more like this:

    • July 1, 2026: the Connecticut AI Academy provision takes effect.
    • October 1, 2026: provenance rules for certain public generative-AI providers, employment-tool framework provisions, anti-discrimination clarifications, and WARN-related AI/technology layoff disclosure provisions take effect.
    • January 1, 2027: companion-chatbot safeguards and frontier-developer reporting provisions take effect.
    • October 1, 2027: certain automated employment-related decision technology deployment duties apply when covered tools are deployed on or after that date.
    • January 1, 2028: certain youth-platform algorithmic and warning provisions take effect.

    That timeline is why this should be treated as an inventory problem, not a headline problem.

    What Companies Should Review Now

    If Connecticut matters to the business, the review should be practical:

    • identify whether any consumer product could fit the law's companion definition;
    • identify whether any hiring or employment workflow uses tools that could materially influence a decision;
    • determine whether any public generative-AI product crosses the monthly-user threshold for the provenance section;
    • review vendor and internal documentation needed to support employment notices;
    • map who owns self-harm response, crisis referral, and notice design for companion-style systems; and
    • track which dates matter for which products, functions, and contracts.

    The legal burden here is not only about whether AI is used. It is about whether the company can show where the law attaches and who owns the response.

    Bottom Line

    Connecticut's Public Act 26-15 is a good picture of how state AI compliance actually arrives.

    Not through one giant theory of artificial intelligence, but through layered rules touching employment, companion products, provenance, internal governance, and youth-facing design. The law is enacted, the dates are staggered, and several of the duties are concrete enough that companies should already know which teams will own them.

    For legal and compliance teams, that is the real lesson. State AI law is getting less theoretical and more operational.

    Sources

  • New York Turns Synthetic-Performer Disclosure Into a Binding Advertising Rule

    New York Turns Synthetic-Performer Disclosure Into a Binding Advertising Rule

    New York now has a live AI advertising disclosure rule.

    That matters because this is not just another policy speech about deepfakes or responsible innovation. It is a binding state law that requires disclosure when advertisements include synthetic performers.

    The practical point is easy to miss. New York did not adopt a broad rule saying every advertisement touched by AI needs a label. It adopted a narrower rule aimed at a specific advertising use case: synthetic people used to sell products or services.

    That narrower framing is exactly why advertisers, agencies, and in-house counsel should pay attention.

    The Short Answer

    • New York's synthetic-performer advertising disclosure law is in effect.
    • The official state materials describe it as requiring people who produce or create an advertisement to identify when it includes AI-generated synthetic performers.
    • The New York Senate bill page describes the measure as carrying a $1,000 civil penalty for a first violation and a $5,000 penalty for subsequent violations.

    What New York Officially Announced

    Governor Kathy Hochul first announced the measure when she signed S.8420-A/A.8887-B in December 2025. The signing release described it as first-in-the-nation legislation requiring individuals who produce or create advertisements to disclose if AI-generated synthetic performers are used.

    The Governor's later June 2026 announcement said the law is now in effect. That release again described the requirement in practical terms: people who produce or create an advertisement must identify if it includes AI-generated synthetic performers.

    The same official announcement describes AI-generated synthetic performers as digitally created media that appear as a real person. It also says those performers are increasingly used across media, including social media and digital advertising.

    That is enough to make the compliance point clear. This is not only a film-industry talking point. New York is framing it as an advertising transparency rule with broader digital relevance.

    This Is Narrower Than “All AI Ads Must Be Labeled”

    The law matters partly because it is targeted.

    It is not framed in the official materials as a blanket requirement to disclose any use of AI in ad production. It is framed around advertisements that include synthetic performers.

    That distinction matters for compliance planning.

    Using AI for copy variants, background cleanup, translation, editing assistance, audience analysis, or production workflow support is not the same thing as using a synthetic human-like performer in the ad itself. New York's rule is important precisely because it focuses on the part consumers are likely to experience as a person-like visual or audiovisual performance.

    That does not make the rule minor. It makes it easier for regulators to explain and easier for advertisers to get wrong if their internal review process still treats synthetic humans as just another creative asset.

    Why The Rule Matters Beyond New York

    This is one of the clearest state examples yet of AI transparency moving into ordinary commercial law.

    The policy logic is simple. If an advertisement presents something that looks like a real human performer, the public may be misled if no disclosure appears and the performer is actually synthetic.

    That puts the law in the same broader family as other AI notice rules Clearon has been tracking, even though the subject matter is narrower than chatbot laws or the EU AI Act's content-labeling framework.

    New York is not trying to solve all AI deception risk in one statute. It is taking one commercially legible category and attaching a disclosure duty to it.

    That is often how these rules spread. Legislatures do not start with a complete theory of synthetic media. They start with a use case that sounds concrete, consumer-facing, and politically defensible.

    The Penalties Are Not Huge, But They Are Real

    The New York Senate bill page describes the measure as imposing a $1,000 civil penalty for a first violation and a $5,000 penalty for any subsequent violation.

    Those numbers are not existential on their own for major brands or agencies. They still matter.

    First, a real penalty means this is not merely guidance. Second, once a disclosure duty exists, a company that misses it may also create knock-on problems in regulatory examinations, platform disputes, contract fights, influencer or talent conflicts, substantiation reviews, or broader deception arguments.

    For many legal teams, the bigger risk is not the face amount of the first penalty. It is having no workflow for deciding when a synthetic person appears in an ad and who is responsible for making sure disclosure happens.

    What Advertisers And Agencies Should Review Now

    If a company uses synthetic people in commercial creative, it should be able to answer a few practical questions quickly:

    • What counts internally as a synthetic performer for campaign review purposes?
    • Which teams can approve ads that include synthetic human-like visuals or performances?
    • Where in the workflow is the disclosure added and checked?
    • Does the review cover social media, short-form video, programmatic creative, influencer-style campaigns, and localized variants?
    • Are agencies, production vendors, and post-production teams required to flag synthetic performer use?
    • Can the brand prove after the fact which campaigns used synthetic performers and what disclosure appeared?

    This is the kind of rule that sounds simple until the asset pipeline gets messy.

    If one team generates the performer, another edits the cut, a third places the media, and a fourth localizes the campaign, disclosure responsibility can disappear in the handoff.

    The Operational Lesson Is Familiar

    The hardest part usually is not writing the notice.

    It is deciding when the rule is triggered, who makes that call, how the decision is documented, and whether the final delivered ad still contains the required disclosure after resizing, localization, reposting, clipping, or repackaging.

    That is why this should be treated as a workflow issue, not only a creative issue.

    Marketing teams may see a fast, cheap way to create human-like commercial content. Legal and compliance teams should see a disclosure trigger that needs a review path.

    Bottom Line

    New York's synthetic-performer law puts a real disclosure requirement into the advertising pipeline.

    The official state materials describe a rule that is already in effect and that requires people who produce or create advertisements to identify when AI-generated synthetic performers are used. The Senate bill page also describes civil penalties for violations.

    For advertisers and agencies, the practical message is direct: if a campaign uses a synthetic person to sell something, disclosure is no longer just a best practice in New York. It is a legal step that should be built into campaign review.

    Sources

  • The New National Security AI Memorandum Has a Vendor-Control Clause Companies Should Notice

    The New National Security AI Memorandum Has a Vendor-Control Clause Companies Should Notice

    The newest White House AI memorandum for the national security enterprise is easy to summarize badly.

    At a high level, yes, it is about faster AI adoption across military and intelligence functions. That much is obvious from the title and the fact sheet.

    The more useful reading is narrower. NSPM-11 is also a procurement, control, and accountability document. It pushes agencies to move faster, but it also says national security systems should not depend on AI tools that a private company can disable, degrade, or materially modify without government knowledge and approval.

    That point should get the attention of contractors, frontier-model vendors, and legal teams working on high-consequence government deployments.

    The Short Answer

    • NSPM-11 tells the national security enterprise to accelerate AI adoption across intelligence and warfighting functions.
    • It also makes vendor control, multi-vendor access, updated autonomy policy, and recurring governance updates part of the Federal AI agenda for national security systems.
    • One of the most practical provisions says agencies should ensure, through contract clauses or other means, that no commercial entity or adversary can prevent use of, disable or degrade, or materially modify an AI system that warfighters rely on.

    What The Memorandum Actually Does

    The memorandum organizes policy around four pillars: adoption, adaptation, assurance, and accountability.

    That framing matters because it is not simply a call to buy more AI. It is a directive to identify mission uses, adapt commercial and open-source systems where possible, demand reliability and control, and keep responsibility with commanders, directors, and agency heads.

    Several implementation pieces stand out.

    First, the memorandum orders an update to DOD Directive 3000.09 on autonomy in weapon systems within 90 days, with annual review after that.

    Second, it calls for an AI governance policy for national security systems within 90 days, with implementation and reporting requirements and an instruction to maximize consistency with broader Federal AI governance rules where appropriate.

    Third, it tells agencies to review procurement processes within 120 days so they can onboard advanced AI models from multiple vendors more quickly.

    Fourth, it directs the government to build more secure computing access, support AI test ranges, create industry security partnerships, expand AI talent pipelines, and launch an AI National Security Strategic Reserve of non-governmental talent.

    This is a serious operating memo, not just a statement of intent.

    The Vendor-Control Clause Is The Provision Companies Should Not Miss

    The strongest practical compliance signal may be in the assurance section.

    The memorandum says the national security enterprise must ensure, through contractual clauses or other means, that no commercial entity or adversary can prevent use of, disable or degrade, or materially modify without Federal Government knowledge and approval an AI system that personnel depend on for missions.

    That is bigger than a generic security aspiration.

    It points toward concrete contracting and product questions:

    • Can the vendor remotely limit, suspend, or alter mission-critical functionality?
    • Can a model provider push material changes without customer approval?
    • Can availability be interrupted by unilateral policy, billing, sanctions, hosting, or safety-gating decisions?
    • Can the government keep using the system in a contested environment or after supplier disruption?
    • What audit trail exists for model updates, safety controls, and configuration changes?

    For companies selling into defense, intelligence, or other national security settings, this starts to look like a product-governance term sheet, not just a policy slogan.

    Multi-Vendor Access Is Not Just About Competition

    The memorandum also criticizes single-vendor dependence and tells agencies to rapidly onboard advanced AI models from multiple vendors.

    That has an obvious competition angle, but it also has a resilience angle.

    If agencies are being told to avoid brittle dependence on one supplier while also making sure no outside entity can silently disable or reshape a mission-critical AI system, vendors should expect procurement scrutiny around portability, continuity, fallback options, and operational control.

    In practice, that can spill into:

    • termination and transition rights,
    • escrow or continuity planning,
    • approval rights for major model changes,
    • logging and notice obligations,
    • deployment architecture choices, and
    • subcontractor flow-downs.

    The legal issue is not just whether the model performs well. It is whether the government can trust the control surface around the model.

    The Contract-Termination Language Raises The Stakes

    Another provision deserves more attention than it has gotten.

    The memorandum directs relevant agencies, to the maximum extent permissible by law, to terminate for default or convenience contracts with companies that have repeatedly shown a pattern of conduct inconsistent with the memorandum's policy, subject to a limited waiver process.

    That does not mean routine AI vendor disagreements will suddenly become termination fights.

    It does mean the document is not only aspirational. It ties the policy to procurement consequences. For AI vendors and prime contractors, that creates a reason to document how products, update practices, surveillance boundaries, speech-related controls, and customer restrictions line up with the memorandum's policy pillars.

    Accountability Still Sits With Human Decision-Makers

    The memorandum is also explicit that commanders, directors, and agency heads remain responsible for ensuring that civil-liberties, privacy, and legal obligations are met.

    That matters because fast adoption documents often get read as if responsibility is being pushed into the tooling layer.

    This one does not do that. It accelerates deployment while keeping human accountability in place. That means agencies will still need governance records showing who approved use cases, what limits applied, what testing occurred, and how oversight kept pace with system changes.

    For vendors, that usually means customer questionnaires, documentation demands, and negotiation pressure around explainability, testing, validation, logging, and update controls.

    Why This Matters Beyond Defense Contractors

    The memo is written for the national security enterprise, but some of its logic is broader than that label.

    If the Federal Government is moving toward AI procurement terms centered on operational control, vendor independence, multi-vendor resilience, and documented accountability, those expectations may not stay neatly confined to warfighting systems.

    Critical-infrastructure programs, sensitive public-sector systems, and other high-consequence deployments may start borrowing the same logic even when this exact memorandum does not apply.

    That is often how these Federal signals travel. The first hard questions show up in national security. The contracting habits spread later.

    What Companies Should Review Now

    Companies that build or supply AI into government or high-consequence environments should be able to answer a few questions now:

    • Who can remotely change, restrict, or disable the product?
    • What contract language governs model updates, service suspension, and customer approval?
    • Can the deployment survive vendor interruption, adversary disruption, or loss of one supplier?
    • What evidence exists for testing, validation, logging, and approval of material changes?
    • Are product, security, legal, and government-sales teams aligned on what control commitments are actually being made?

    If those answers are fuzzy, NSPM-11 is a useful reason to tighten them.

    Bottom Line

    NSPM-11 is not just a message that national security agencies should use more AI.

    It is also a signal that the government wants advanced AI systems it can control, validate, sustain, and procure without fragile dependence on a single vendor or silent private-sector override. The memorandum's vendor-control clause and contract-termination language are the parts companies should read most carefully.

    For contractors and AI vendors, the practical takeaway is simple: capability matters, but control rights, update rights, resilience, and documentation are becoming part of the product.

    Sources

  • Oregon’s New AI Companion Law Shows Where Chatbot Regulation Is Headed Next

    Oregon’s new AI companion law makes one thing harder to deny: this is no longer a two-state experiment.

    California already enacted a companion chatbot law. New York’s companion safeguards are now in effect. Oregon now adds a third enacted state model through SB 1546, chaptered as Chapter 85.

    The three states did not copy one another line for line. They did land on the same basic instinct. When a chatbot is human-like enough that a reasonable person might think they are dealing with a natural person, lawmakers increasingly want disclosure, safety rules, and an enforcement path.

    That is why Oregon matters. It makes the pattern easier to see.

    For broader companion-chatbot coverage, see Clearon’s earlier piece on AI Companion Safety Laws Are Becoming a Real Compliance Category.

    What Oregon Did

    Oregon’s SB 1546 is now chaptered as Chapter 85.

    The official state materials indicate that the law requires notice when a reasonable person would believe they are interacting with a natural person. The same materials also indicate that a user who suffers ascertainable harm can seek damages and injunctive relief.

    That combination matters.

    Much of AI regulation is still stuck at the level of agency guidance, draft rules, or future obligations. Oregon’s law is not. It is a state statute aimed at a narrow product category with both a disclosure concept and a private enforcement hook. That makes it a real compliance signal, not just a policy talking point.

    The Law Starts At The Relationship Layer

    The interesting part is where Oregon starts.

    It does not begin with frontier-model debates, general AI risk theory, or a broad licensing framework. It starts with the user experience. If the product is human-like enough that a reasonable person could take it for a natural person, the law cares.

    That move is starting to repeat.

    California’s companion chatbot law also uses a nonhuman-disclosure model, with additional minors and self-harm safeguards. New York’s law requires conspicuous recurring notices that users are interacting with AI, not a human, along with crisis-intervention protocols. Oregon now reinforces the same basic idea from another direction: do not let a relationship-style AI system pass as human without legal consequences.

    This is why companion-chatbot regulation looks different from a lot of other AI law. The pressure point is not only model capability. It is simulated human interaction.

    Why Oregon Matters Beyond Oregon

    One enacted state law can be dismissed as an outlier. Three enacted state models are harder to wave away.

    That does not mean every state will use the same definitions or remedies. It means companies now have more reason to assume that relationship-like AI systems will keep drawing targeted legislation, especially where minors, self-harm, dependency, sexual content, or emotionally manipulative design are in the frame.

    Oregon also helps confirm that nonhuman notice is becoming the floor.

    The disclosure duty is the first thing lawmakers can agree on. If the system feels human, tell the user it is not. After that, the next questions usually follow fast:

    • what happens when a user shows signs of crisis;
    • what the product does for minors;
    • whether the design rewards emotional dependence;
    • what marketing claims were made about safety or support; and
    • what records the company can produce if a regulator or plaintiff asks how the product was reviewed.

    That broader pattern already appears in Clearon’s recent FTC companion-chatbot coverage and in the other state companion laws. Oregon fits squarely inside it.

    The Private Enforcement Angle Matters

    The Oregon measure overview’s reference to damages and injunctive relief is one reason this story deserves its own article.

    Disclosure rules matter on their own. Disclosure rules backed by a harmed-user action create a sharper litigation question. They raise the stakes for product teams that still treat chatbot identity notices as soft UX copy rather than compliance language tied to a product design theory.

    That does not mean every case will be easy to prove. It does mean the compliance conversation changes when a statute gives users an avenue to claim harm from noncompliance.

    For in-house teams, that makes Oregon more than a notice law. It is a warning that chatbot identity, safety design, and consumer expectations can become plaintiff-side issues as well as regulatory ones.

    What Companies Should Review Now

    Companies offering companion or emotionally responsive chatbots should not treat Oregon as a one-off state update to file away.

    They should use it as a trigger to review:

    • whether any product could reasonably be perceived as a natural person or relationship-style companion;
    • where nonhuman notices appear, how clear they are, and whether they recur when interactions continue;
    • how the product handles minors, emotionally vulnerable users, and crisis scenarios;
    • whether marketing or onboarding language overstates safety, support, or human-like qualities;
    • whether engagement design could be framed as encouraging dependence or extended emotional reliance; and
    • what internal records exist showing how those decisions were made before launch.

    The records point matters. A lot of companion-AI risk is turning into a proof problem. If a company says it disclosed the system’s nature, tested foreseeable harms, and built safeguards, it should be able to show the file.

    That is also where Oregon connects to the FTC’s 6(b) inquiry. The law and the inquiry use different tools, but they are pushing toward the same practical result: companies should expect to explain how relationship-like AI products were designed, disclosed, tested, and governed.

    Bottom Line

    Oregon’s new AI companion law is not just another state headline.

    It is more evidence that chatbot regulation is moving to the relationship layer. If a system is built to feel human, keep users engaged, and occupy an emotionally salient role, lawmakers are increasingly treating that as its own legal problem.

    For companies building companion-style AI, the lesson is direct. A generic chatbot disclosure and a moderation policy are not enough. Oregon suggests that states are looking for something more specific: clear nonhuman notice, a defensible safety approach, and an enforcement path when those basics fail.

    Sources

  • Why Transparency Keeps Becoming AI Regulation’s Common Rule

    Why Transparency Keeps Becoming AI Regulation’s Common Rule

    The latest EU AI Act update says something bigger than "the Code moved forward."

    On July 9, the European Commission said the Code of Practice on Transparency of AI-Generated Content adequately covers Articles 50(2), (4), and (5) of the AI Act, and the AI Board adopted its own adequacy assessment the same day.

    That does not make the Code binding law. Article 50 is the binding law. The Code is still a voluntary path ahead of the August 2, 2026 obligations.

    What matters more is the pattern behind it. AI regulators disagree on plenty: liability, model governance, private lawsuits, safety testing, and federal versus state control. They still keep landing on the same move first: tell people when AI is involved, label synthetic content, disclose key terms, and keep a record showing the disclosure was real.

    For broader tracking context, see Clearon's Laws, Bills & Regulations page.

    The EU Update Shows The Pattern Clearly

    The EU's Article 50 framework already made this one of the clearest early-operating obligations in the AI Act.

    The Commission's final Code of Practice on marking and labelling AI-generated content was designed to help providers and deployers meet those duties. It covers provider-side marking and detection of AI-generated or manipulated content and deployer-side labelling of deepfakes and certain AI-generated or AI-manipulated text published on matters of public interest.

    The July 9 adequacy assessment matters because it makes that framework more usable. Companies that sign and follow the Code get a clearer EU-wide path for demonstrating compliance. Companies that choose another method can still do that, but they will need to defend their own approach.

    That is the recurring move. The law does not stop at whether a system is safe in the abstract. It asks whether users, viewers, readers, and regulators can tell when AI-generated or AI-manipulated content is in play and what controls were used.

    This Is Not Just An EU Idea

    These duties keep appearing in very different AI rules, often with different policy goals and enforcement structures.

    Oregon's newly chaptered companion-chatbot law requires non-human notices when a reasonable person would think they are interacting with a natural person. That is not an EU-style content-labelling rule, but the regulatory instinct is the same: if AI is standing in for a human relationship or interaction, the law increasingly wants the user told so.

    Colorado's conversational AI law works the same way. Effective January 1, 2027, operators must disclose that the service is AI while also meeting age-estimation, minor-safety, self-harm, privacy, and reporting requirements. Again, the state did not start with frontier-model theory. It started with disclosure.

    New York's AI companion safeguards take a similar approach. Covered operators must provide conspicuous recurring notices that users are interacting with AI, not a human, including every three hours of continued companion use. That is an unusually concrete example of transparency as an ongoing duty rather than a one-time buried term.

    Connecticut's consumer generative-AI subscription law is different in subject matter but similar in structure. It does not focus on deepfakes or companion chatbots. It requires disclosure of key subscription terms and written consumer acceptance before entering into or renewing certain generative-AI subscriptions or collecting payment. The issue there is transactional rather than synthetic-content-related, but it is still a rule built around telling the user what matters before money changes hands.

    New York's synthetic-performer advertising law adds another example. It requires disclosure when advertisements include AI-generated performers. New York's FAIR News Act proposal would require conspicuous disclosure when news media content is substantially created by generative AI. California's SB 947 employment bill would add worker notice and access rights around automated decision systems. Different sectors, different politics, same instinct.

    That is why this looks less like one topic inside AI law and more like the first rule lawmakers can agree on.

    Why This Rule Keeps Winning

    There are practical reasons for that.

    Transparency is easier to legislate than a complete theory of AI safety. "Label this," "disclose that," and "tell the user this is AI" are easier rules to draft and explain than rules that try to settle contested questions about model capability, causation, fairness metrics, or acceptable levels of autonomy.

    It is also easier to enforce. Regulators can check whether a notice appeared, whether a label was conspicuous, whether terms were disclosed, whether a user was informed, and whether records exist to support those claims.

    It is also politically durable. Even when lawmakers disagree about whether AI should be slowed down, promoted, tightly licensed, or mainly governed through existing consumer-protection law, disclosure rules survive because they sound modest and hard to oppose. Telling people that content is synthetic or that a chatbot is not human reads like a baseline fairness rule.

    That does not make it trivial. In practice, it can be operationally messy.

    The Hard Part Is Not Writing The Label

    Most companies do not struggle with the sentence itself. They struggle with the workflow behind it.

    For the EU AI Act, that means identifying which systems and outputs fall within Article 50, deciding when text is published on a matter of public interest, determining when content is AI-generated or AI-manipulated, and making sure labels or machine-readable markers survive distribution.

    For companion-chatbot laws, it means deciding when an interaction is human-like enough to trigger notice duties, where the notice appears, how often it reappears, how minors are handled, and what records show the company actually delivered the disclosure.

    For subscription and advertising laws, it means mapping payment flows, renewal flows, ad production processes, and approval chains so the promised disclosure is not separated from the user decision it is supposed to inform.

    The regulatory pattern may be simple. The implementation pattern is not.

    What Companies Should Take From The EU Update

    The Commission's adequacy assessment is a reminder that these obligations are moving out of policy decks and into operational compliance.

    The Article 50 Code is voluntary, but it now looks more like the default evidence path for many organizations subject to the EU framework. That should push companies to ask a broader question: where else in the business are AI notice, labeling, or disclosure duties already becoming mandatory?

    A good cross-jurisdiction review should identify at least four things:

    • where the company generates or publishes synthetic content;
    • where users interact directly with AI systems that could be mistaken for humans;
    • where customers, workers, or the public are asked to rely on AI-affected outputs or offers; and
    • what records show the company actually delivered the relevant notice, label, or disclosure.

    Companies that only track "high-risk AI" or "model governance" may miss the compliance lane that is already becoming the most common one.

    Bottom Line

    The new EU milestone is not just another Brussels process update.

    It is evidence that one of the few truly durable ideas in AI regulation is simple: people should be told when AI is shaping what they see, hear, buy, or rely on. The EU is doing it through Article 50 marking and labelling. Oregon, Colorado, New York, Connecticut, and pending California measures are doing it through chatbot notices, subscription disclosures, synthetic-performer disclosures, news-content disclosures, and worker notice rights.

    The details differ. The throughline is hard to miss.

    When AI law cannot agree on everything else, it keeps agreeing on that.

    Sources

  • Delaware Chancery Orders Lawyer and Firm to Explain GenAI Briefing Failures

    Delaware Chancery Orders Lawyer and Firm to Explain GenAI Briefing Failures

    The Delaware Court of Chancery just handed down a useful AI opinion, and the useful part is not a final sanctions award.

    It is the court's decision to force both the signing lawyer and the law firm to explain, in detail, how a GenAI-tainted brief made it onto the docket.

    In Kevin Leiske et al. v. Robert Gregory Kidd et al., Vice Chancellor Lori Will ordered Richard P. Rollo and Richards, Layton & Finger to show cause why they should not be sanctioned under Rule 11 and the court's inherent authority. The July 1 order says the answering brief contained fictitious citations, fabricated quotations, and hallucinated legal propositions. It also says the problems got worse after the errors were flagged.

    That makes this more than another fake-citation story.

    Why This Order Matters

    The Delaware opinion is not just about whether a lawyer used AI badly.

    It is about what a court wants to know after that happens:

    • who used the tool,
    • who entered the prompts,
    • how the output was incorporated,
    • who was supposed to verify it,
    • whether lawyers personally checked the authorities, and
    • what firm safeguards existed at the time.

    That is a more mature court response than a generic warning not to trust AI.

    The court is treating GenAI misuse as a workflow, supervision, and certification problem.

    What The Court Said Happened

    According to the order, the plaintiffs' January 22 answering brief contained false citations, fabricated quotations, and legal propositions that the cited authorities did not support.

    The next day, after the defendants flagged the problems, plaintiffs' counsel acknowledged that a generative AI tool had been used to revise the brief. Counsel admitted the citations were not verified before filing and attributed the lapse to a paralegal's review.

    That did not end the problem.

    The court said the corrected brief removed quotation marks around erroneous statements of law but did not fix the underlying inaccuracies. It also took a dim view of counsel's argument that opposing counsel should have met and conferred before alerting the court. Vice Chancellor Will wrote that there is nothing to negotiate when a filing presents false citations to a tribunal.

    That passage is worth remembering. Courts may expect parties to meet and confer over ordinary disputes. They are not likely to treat false authority in a filed brief as a routine discovery squabble.

    The Firm Is In It Too

    The sharpest part of the order may be the firm-level piece.

    Delaware Chancery Rule 11(c)(1) says that absent exceptional circumstances, a law firm must be held jointly responsible for Rule 11 violations committed by its partners, associates, or employees. Vice Chancellor Will said this incident may implicate the firm's training, supervision, and deployment of GenAI, so the firm must answer alongside the signatory.

    That is what makes the order especially useful for law firm leaders.

    Many AI discussions still drift toward individual blame: which lawyer signed, which associate drafted, which paralegal cite-checked, which tool hallucinated. This order looks past that first layer. It asks what policies, training, and safeguards the firm had in place before the filing was made.

    What The Court Wants Explained

    The show-cause order requires separate affidavits from the signatory lawyer and an authorized firm representative by July 15.

    For the lawyer, the court wants:

    • a timeline showing how and when the GenAI tool was used in drafting the brief;
    • who entered prompts and how the output was added to the filing;
    • a description of the cite-checking process before filing;
    • what instructions were given to paralegals;
    • what verification tools were used;
    • whether attorneys verified the cited text; and
    • why the corrected brief removed quotation marks but kept flawed legal propositions.

    For the firm, the court wants:

    • written GenAI policies, guidelines, and restrictions that were in effect at the time;
    • how those policies were communicated to the lawyers and staff involved;
    • what internal safeguards or training the firm has implemented or plans to implement; and
    • any claimed exceptional circumstances for avoiding joint responsibility.

    That is close to a court-issued AI governance checklist.

    What This Means For Firms Using AI

    The Delaware order does not hold that AI use in drafting is forbidden. In fact, Vice Chancellor Will repeated the now-familiar point that using GenAI in legal work is not inherently problematic if the output is carefully verified.

    The problem is that verification cannot be vague, delegated away, or assumed.

    If a court asks how an AI-assisted brief was produced, a firm should be ready to show more than a policy memo. It should be able to explain the actual workflow:

    • which tools were approved;
    • what legal and factual checks were required before filing;
    • whether the signing lawyer personally reviewed the sources;
    • how staff cite-checking fit into the process; and
    • what happens when an error is found after filing.

    That is where a lot of firms are still thinner than they think.

    Why This Is A Good Follow-On To The Recent Cases

    Clearon has already covered opinions focusing on false quotations, fabricated authorities, and verification failures in appellate and trial-court filings.

    The Delaware order adds a different layer. It is not just asking whether the brief was wrong. It is asking how the law firm's internal AI controls worked, and whether they worked at all.

    That makes it a strong Courts and AI story. It sits at the intersection of court sanctions doctrine, supervisory responsibility, and practical AI governance inside firms.

    Bottom Line

    The Delaware Court of Chancery has not imposed final sanctions in Leiske yet. But the July 1 show-cause order already says a lot.

    It says GenAI mistakes in a filed brief can become a Rule 11 problem. It says deleting quotation marks without fixing the legal proposition is not a real correction. And it says firms should expect courts to ask about policies, training, verification, and supervision when AI-assisted work goes wrong.

    That is the part worth watching.

    Sources

  • The Perplexity Publisher Cases Are Becoming a Real S.D.N.Y. Cluster

    The Perplexity Publisher Cases Are Becoming a Real S.D.N.Y. Cluster

    The Perplexity cases are no longer just one publisher dispute with a few echoes around it.

    The filings now show something more structured: repeated publisher plaintiffs, the same defendant, the same court, and relatedness filings that tie the newer suits back to the earlier ones.

    That is why the better way to read these cases now is as a real Southern District of New York cluster.

    This point is procedural before it is substantive. It does not tell us who will win. It does tell us that the Perplexity litigation map is getting denser in one court, and that matters on its own.

    The Short Answer

    • Perplexity is no longer facing just one major publisher case in S.D.N.Y.
    • Court filings now show a growing set of publisher actions in the same court, with relatedness filings linking newer cases to earlier ones.
    • That does not create formal consolidation by itself, but it does make the litigation easier to understand as a cluster rather than a series of isolated disputes.

    The Anchor Case Came First

    The best starting point is still Dow Jones & Company, Inc. v. Perplexity AI, Inc.

    That case put a major publisher plaintiff and Perplexity into S.D.N.Y. on a copyright-centered answer-engine theory. On its own, it could still have been treated as one important lawsuit against one AI company.

    That is no longer the full picture.

    The New York Times And Chicago Tribune Cases Changed The Shape

    In December 2025, two more publisher suits were filed against Perplexity in the same court.

    The New York Times Company v. Perplexity AI, Inc. was filed on December 5, 2025. The docket includes a statement of relatedness pointing back to Dow Jones & Company, Inc. v. Perplexity AI, Inc.

    Chicago Tribune Company, LLC v. Perplexity AI, Inc. was filed on December 4, 2025. That docket also includes a statement of relatedness pointing back to the Dow Jones action.

    Those filings matter because they show the cases were not framed as unrelated one-offs. From the start, the newer publisher complaints were being tied back to the earlier Perplexity case in the same court.

    CNN Makes The Cluster Harder To Ignore

    The pattern became even harder to miss when Cable News Network Inc. v. Perplexity AI, Inc. was filed on May 28, 2026.

    The CNN docket includes a statement of relatedness tying the case to The New York Times Company v. Perplexity AI, Inc. The docket also shows an earlier relatedness filing attempt referencing the Chicago Tribune matter.

    That is not just another headline plaintiff. It is another sign that the Perplexity publisher cases are being filed with one eye on the surrounding map.

    Why The Cluster Framing Matters

    Calling these cases a cluster is not just a visual convenience.

    It changes how the litigation should be watched.

    Once several publisher suits sit against the same defendant in the same court, a few practical questions become more important:

    • whether judges start treating the cases as part of one broader dispute landscape;
    • whether overlapping pleadings sharpen a common theory about answer-engine substitution or output-side competition;
    • whether procedural coordination pressure increases even without full consolidation;
    • whether discovery, motion practice, or settlement posture in one case starts influencing expectations in the others; and
    • whether additional publisher plaintiffs see S.D.N.Y. as the natural forum for similar claims against Perplexity.

    That does not require the cases to become one proceeding. The cluster effect can matter well before that.

    This Is Still Not A Merits Answer

    The cluster point should not be overstated.

    These dockets do not prove that the publishers' claims are right. They do not tell us whether Perplexity's defenses will succeed. They do not resolve how courts will draw lines between training issues, output issues, substitution theories, trademark theories, or fair-use arguments.

    They do show something narrower and still important.

    Perplexity is no longer dealing with a single flagship publisher suit in isolation. It is dealing with a growing publisher map in one federal court.

    That is a meaningful litigation development even before any decisive merits ruling arrives.

    The Useful Question Now Is What Repeats

    For Clearon readers, the most useful next step is to watch for repetition across the Perplexity dockets.

    The more the same themes repeat, the more clearly this becomes a real litigation category rather than a collection of separate complaints.

    The questions to track are straightforward:

    • Which claims appear across multiple publisher cases?
    • How often do plaintiffs frame Perplexity as a substitute for original publisher content rather than just a training-data user?
    • Do the pleadings keep centering answer-engine behavior, branding, or output presentation?
    • Does S.D.N.Y. begin to look like the home court for this publisher-versus-answer-engine fight?

    Those repetition points may become more informative than any single complaint standing alone.

    Bottom Line

    The Perplexity publisher cases are becoming a real S.D.N.Y. cluster because the filings now show repeated publisher plaintiffs, repeated relatedness filings, and repeated use of the same court.

    That does not answer the merits. It does answer something else that matters right now.

    Perplexity is facing a denser and more legible publisher-litigation map than it was a few months ago. For anyone tracking AI litigation, that is already a story worth treating as its own development.

    Sources